Which technique is commonly used to reduce false positives in a SIEM?

Tuning detection rules to better match the environment's normal behavior

Disabling all detection rules to avoid alerts

Assigning a higher priority to all alerts

Increasing the number of alerts generated by each rule

What is the primary purpose of an escalation procedure in a SOC?

To document all alerts for compliance purposes

To ensure that significant incidents receive the appropriate level of expertise and response

To reduce the number of alerts in the queue

To automatically resolve all high-severity alerts

Which of the following best distinguishes alert severity from alert priority?

Severity is used for reporting, while priority is used for alert generation.

Severity indicates the likelihood of the event, while priority indicates the certainty of the threat.

Severity is based on the potential impact of the event, while priority is based on the urgency and business context.

Severity is assigned by the analyst, while priority is assigned by the SIEM automatically.

A SOC team notices that a rule detecting brute-force attacks generates many alerts for a single user who frequently mistypes passwords. The team wants to reduce false positives without missing real brute-force attacks. What is the best approach?

Increase the threshold for the number of failed attempts before an alert is triggered.

Create a separate rule for that user with a lower threshold.

Lower the severity of the rule to reduce attention.

Disable the rule for that specific user.

A SOC analyst notices that a security monitoring tool generated an alert when a specific string of bytes appeared in network traffic. What is the most likely mechanism that triggered this alert?

A signature-based detection rule matched the byte pattern against known malicious indicators.

The tool randomly selected the traffic as part of a periodic sampling process.

A user manually reviewed the traffic and submitted a report to the SIEM.

An anomaly-based model learned the normal traffic baseline and flagged the deviation.

EC-CouncilSOC Essentials

Domain 6Objective 3

Alerting and Triaging Alerts SCE Practice Questions (Page 5)

Part of the Incident Detection and Analysis domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 1–2 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

8concepts

Questions 21–25

21foundation · easy
Which technique is commonly used to reduce false positives in a SIEM?
Select an answer first
22foundation · easy
What is the primary purpose of an escalation procedure in a SOC?
Select an answer first
23foundation · easy
Which of the following best distinguishes alert severity from alert priority?
Select an answer first
24application · medium
A SOC team notices that a rule detecting brute-force attacks generates many alerts for a single user who frequently mistypes passwords. The team wants to reduce false positives without missing real brute-force attacks. What is the best approach?
Select an answer first
25foundation · easy
A SOC analyst notices that a security monitoring tool generated an alert when a specific string of bytes appeared in network traffic. What is the most likely mechanism that triggered this alert?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.